Core Contracts

Summary

The RToken contract fails to maintain proper scaling of token amounts relative to the interest index throughout its lifecycle, affecting both minting and burning operations. This breaks the core interest accrual mechanism of the protocol.

Vulnerability Details

The contract incorrectly handles scaled amounts in two critical operations:

1. During Minting (Deposits):

1. During Burning (Withdrawals):

Example scenario:

Initial State:
Index = 1.0
User deposits 100 crvUSD

Current Implementation:

1. Deposit (Index = 1.0):

   • Calculates scaled = 100/1.0 = 100

   • Mints 100 rTokens (incorrect)

2. Time passes, Index = 1.1

   • User balance shows: 100 1.1 = 110 crvUSD

3. Withdrawal: ( exact rTokens = 100)

   • Burns 100 rTokens

   • Receives 100 crvUSD (missing interest)

   • Cannot withdraw remaining 10 crvUSD interest

4. Withdrawal: ( user balance = 110 )

   • Burns 110 rTokens -> will revert

Impact

Users lose accrued interest due to improper scaling

Tools Used

Manual Review

Recommendations

Consistently use scaled amounts throughout the minting and burning cycle to account for any interest accrued